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This report documents a review by the staff of the Defense Nuclear Facilities Safety 
Board (Board) of the 2011 Documented Safety Analysis (DSA) for the Plutonium Facility (PF-4) 
at Los Alamos National Laboratory (LANL). The review included assessment of the 2011 DSA 
update and revisions, the safety evaluation report developed by the National Nuclear Security 
Administration's (NNSA) Los Alamos Site Office (LASO) to approve the DSA, as well as an 
on-site review performed during the week of March 19, 2012. Follow-up discussions with 
LANL and NNSA personnel occurred on April 26, 2012. Staff members F. Bamdad, 
B. Broderick, T. Chapman, T. Davis, C. March, J. Pasko, and R. Verhaagen participated in 
elements of the review. 

Background. In December 2008, the LASO manager approved the first major update to 
PF-4's safety basis since 1996. The 2008 DSA postulated a seismically-induced fire scenario for 
PF-4 and reported a mitigated offsite dose consequence of greater than two thousand rem total 
effective dose equivalent (TEDE) for this event. As a result of this large mitigated offsite 
consequence, the Board issued Recommendation 2009-2, Los Alamos National Laboratory 
Plutonium Facility Seismic Safety. In this Recommendation, the Board urged NNSA and LANL 
to execute both immediate and long-term actions to reduce the risk posed by a seismic event at 



In response to the Board's Recommendation, NNSA and LANL personnel: (1) executed 
a series of near-term compensatory measures designed to reduce the risk of a seismically- 
induced fire at PF-4; (2) identified a number of new safety -class engineered controls, including 
seismic cutoff switches for electrical power, seismically qualified material storage safes, and 
fire-rated material storage containers; and (3) developed a Project Execution Plan for longer-term 
upgrades to enable the confinement ventilation and fire suppression systems to perform safety- 
class functions following a Performance Category (PC)-3 seismic event. 

In addition to physically upgrading the building structure and implementing new safety- 
class engineered controls, laboratory personnel completely reanalyzed the seismically-induced 
fire scenario in the 2011 DSA. The new analysis in the 2011 DSA concludes that the mitigated 
offsite dose consequence for the seismically-induced fire scenario is 23 rem TEDE, which is less 



PF-4. 



than the Department of Energy (DOE) Evaluation Guideline of 25 rem TEDE. This analyzed 
offsite dose consequence is two orders of magnitude lower than the mitigated offsite dose 
consequence calculated by the 2008 DSA. The roughly 100-fold decrease results from changes 
to four accident analysis parameters: the quantity of material at risk, airborne release fractions, 
respirable fractions, and leak path factor (LPF). Revision 1.0 of the 2011 DSA was approved by 
LASO on October 13, 2011, and the DSA and its associated technical safety requirements (TSR) 
are currently scheduled to be implemented by June 25, 2012. 

Justification for Continued Operations. Subsequent to the Recommendation and 
efforts by LANL that considerably reduced offsite dose consequences, LANL engineers 
evaluated the impact of the most recent update to the site's Probabilistic Seismic Hazard 
Analysis (PSHA). These PSHAs are conducted approximately every ten years to update the 
threats from earthquakes. This latest PSHA predicted an increase in the magnitude of seismic 
ground motions, leading to severe seismic accident scenarios, such as facility collapse, becoming 
more credible. A Justification for Continued Operations (JCO) that addressed these new severe 
seismic accident scenarios was approved by NNSA in July 2011. This JCO supplements the 
DSA as the governing safety basis for the facility. It will serve as the safety basis of record until 
superseded by implementation of the 2011 DSA. 

In response to the discovery that critical structural elements of PF-4 were seismically 
vulnerable, NNSA and LANL personnel initiated and successfully completed physical upgrades 
that addressed all known structural vulnerabilities. (However, farther seismic analysis is in 
progress that could reveal additional vulnerabilities.) 

Path Forward. Once implementation of the 2011 DSA is independently verified, LANL 
personnel intend to retire the seismic JCO. Consequently, the Board's staff carefully reviewed 
the four accident analysis parameters that serve as the underpinning of the 2011 DSA: the 
quantity of material at risk, airborne release fractions, respirable fractions, and LPF. The 
Board's staff noted a substantial number of issues, discussed below, that challenge the technical 
basis for these parameters and, consequently, for the 23 rem TEDE mitigated offsite dose 
consequence reported in the 2011 DSA. 

Leak Path Factor Analysis. The 2008 DSA postulated that a seismically-induced fire 
would engulf the entire laboratory floor of PF-4 and generate sufficient thermal energy to drive a 
large fraction of aerosolized material out of the building resulting in a LPF of 40 percent. The 
2011 DSA uses a 3 step approach to derive a new, lower LPF for the reanalyzed seismically- 
induced fire scenario. The first step analyzes historical data related to the number of fires 
reported following earthquakes in California and Alaska to develop a probabilistic argument that 
seismically-induced fires will be limited to some number of individual laboratory rooms rather 
than affecting the entire laboratory floor. The second step uses Consolidated Model of Fire and 
Smoke Transport (CFAST) software to model fires and develop thermal and material transport 
profiles as a function of time for selected laboratory rooms where seismically-induced fires were 
assumed to be present. The final step uses Methods for Estimation of Leakages and 
Consequences of Releases (MELCOR) software to calculate the fraction of material released 
from the building (i.e., the LPF). The 2011 DSA credits the safety-class building structure to 
maintain its confinement integrity during a PC-3 seismic event and to mitigate releases from 
seismically-induced accidents. The DSA relies on the passive confinement of PF-4 structure to 
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mitigate the material release and associated offsite dose consequence from a seismically-induced 
fire scenario. The staff identified a number of issues, described below, that challenge the 
technical validity and defensibility of the LPF values used in the 2011 DSA. A number of these 
LPF-related issues are similar to concerns communicated by the Board in a letter to NNSA dated 
May 30, 2008. 

LPF Value for the Spill Contribution to the Seismically-induced Fire — The MELCOR 
analysis that generated the LPF values used in the 2011 DSA included a number of parametric 
runs. For a given parametric run, a number of individual laboratory rooms were assumed to 
contain seismically-induced fires and a given amount of material at risk (MAR) was allocated to 
each fire. Additionally, rooms without fires (non-fire rooms) were also modeled with a given 
amount of MAR which was spilled. The MELCOR analysis that generated the bounding LPF 
value (18 percent) used in the 2011 DSA modeled an integrated seismic accident scenario that 
involved releases due to both seismically-induced fires in two fire rooms and seismically- 
induced spills in fourteen non-fire rooms. 

The LPFs generated using MELCOR are ultimately used in the DSA accident analysis to 
calculate dose consequences. For the seismically-induced fire scenario, the DSA accident 
analysis assumes that material is spilled and then becomes involved in a fire. This accident 
analysis evaluates the dose contributions from the spill release and the fire release separately and 
then combines the results to obtain the total mitigated offsite consequence of 23 rem TEDE. 
Consequence calculations for the fire component of the release use the 18 percent LPF calculated 
by the MELCOR model discussed above. However, consequence calculations for the spill 
component of the release use an LPF of only 5 percent. Given that the 18 percent LPF value was 
calculated in MELCOR for an integrated scenario that included both spill and fire releases, it is 
not technically justifiable to use a separate, lower LPF value for the spill contribution. If the 
appropriate LPF value of 18 percent were applied to the spill component of the release, the 
Board's staff estimates the dose contribution of the spill would increase by a factor of 3.6, and 
the overall offsite dose consequence would increase by roughly 80 percent. 

Implicit Crediting of Laboratory Walls — The walls of PF-4's laboratory rooms consist of 
gypsum board panels that are mechanically fastened to metal framing. These laboratory walls 
have not been credited as safety-class or safety-significant design features in the PF-4 DSA and 
have not been evaluated to maintain their integrity in a PC-3 seismic event. However, the 
CFAST and MELCOR models for PF-4 rely on an assumption that laboratory walls will remain 
intact after an earthquake. By assuming the laboratory walls are intact, the amount of oxygen 
available to feed a room fire is constrained and the overall size and heat release rate from the fire 
are limited. Additionally, assuming laboratory walls are intact significantly limits the surface 
area of flow paths through which the aerosolized source term can escape from fire rooms into the 
corridor and ultimately into the environment. Inappropriately relying on laboratory walls to 
perform functions that they are not credited or qualified to perform is a non-conservative 
assumption that potentially underestimates the LPF and overall offsite dose consequence. 

Quantity of Combustibles Assumed for Some Fire Rooms — Laboratory rooms that process 
heat source plutonium-238 (HS-Pu) materials include fixed and mobile polymethyl methacrylate 
(PMMA) shielding to reduce the neutron dose to glovebox workers. The PMMA shielding is 
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combustible and represents a large potential source of fuel to feed HS-Pu laboratory room fires. 
Room fire characteristics calculated by CFAST and input into MELCOR are strongly influenced 
by the quantity of combustible materials present to fuel the fire. The CFAST modeling of HS-Pu 
laboratory room fires assumes that the amount of PMMA is limited to the fixed PMMA shielding 
on only four gloveboxes and does not account for the significant amount of mobile PMMA 
shielding present. There are more than four gloveboxes in one HS-Pu room, and all have the 
potential for becoming involved in a fire. Therefore, postulating an HS-Pu room fire that 
involves only combustible fuel from the fixed PMMA shielding of four gloveboxes is also a non- 
conservative assumption that leads to an underestimation of LPF values and overall offsite dose 
consequences. 

Respirable Fraction for Finely Divided Heat Source Plutonium Powder. Unlike the 
2008 DSA, the accident analysis for the seismically-induced fire scenario in the 2011 DSA 
disaggregates MAR to account for the wide variability in dose conversion factors and 
dispersibility represented by the diverse materials present in PF-4. Under this new approach, 
finely divided HS-Pu powder is one of the most important contributors to the overall offsite dose 
consequence. HS-Pu is enriched in the Pu-238 isotope, which has a high specific activity and 
dose conversion factor. Mechanical processing creates a very finely divided powder with an 
average particle size of approximately 1 micron geometric diameter (or about 3.5 microns 
aerodynamic equivalent diameter [AED]), which makes it highly dispersible and respirable under 
accident conditions. DOE Handbook 3010, Airborne Release Fractions/Rates and Respirable 
Fractions for Nonreactor Nuclear Facilities, defines respirable fraction (RF) as the fraction of 
material that has an AED of 10 microns or less. The DSA assumes an RF of 0.3 for finely 
divided HS-Pu powder that is released in a seismically-induced spill and an RF of 0.1 for finely 
divided HS-Pu that is released in a fire. 

The RF value of 0.3 assumed for finely divided HS-Pu powder spilled in a seismic event 
uses the bounding experimental RF value, derived from unrepresentative test materials, reported 
in DOE Handbook 3010. However, this value may not be appropriate for finely divided HS-Pu 
where the source material is initially all in the respirable particle size regime. This is reflected in 
Section 3.4.3 of the 2011 DSA in the accident analysis for a container handling event. This 
scenario analyzes the consequences of dropping and breaching a HS-Pu container. This DSA 
evaluation states that if the material involved in the accident is finely divided HS-Pu powder, 
then an RF of 1.0 must be assumed. 

LANL analysts derived the assumed fire RF of 0.1 by taking the bounding experimental 
value of 0.01 from DOE Handbook 3010, which is based on experiments using test materials that 
are not representative of finely-divided HS-Pu powder, and increasing it by an arbitrary factor of 
10. The analysts indicated that the factor of 10 is intended to account for the difference between 
finely divided HS-Pu powder with an average particle size of about 3.5 microns AED and the 
much coarser test materials with particle sizes of 15-150 microns AED that were used in the 
experiments reported in the Handbook. The DSA notes that the assumed RF for finely divided 
HS-Pu powder in fires was only increased to 0.1 rather than to 1.0 as in previous versions of the 
analysis because powders with small initial particle sizes tend to agglomerate into larger and less 
respirable particles. 
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To support this agglomeration argument, the DS A references a white paper submitted by 
an author of DOE Handbook 3010 that discusses agglomeration phenomena observed in 
experiments performed using finely divided uranium oxide. However, the Pu-238 constituent of 
HS-Pu has properties and characteristics that are significantly different than uranium oxide. Pu- 
238 is an intense alpha emitter with a relatively short half-life of 88 years. As a result of this 
high specific alpha activity, Pu-238 oxide material exhibits significant self-heating (hence its use 
as a heat source) that tends to drive off moisture and limit water adsorption. Self-heating of Pu- 
238 oxide would tend to cause finely divided HS-Pu powder to resist particle agglomeration. 
The white paper referenced in the DSA also assumes the presence of conditions that do not exist 
in the facility, such as seismically-qualified support stands for HS-Pu gloveboxes. Since HS-Pu 
behaves differently than uranium oxide and exhibits characteristics that would resist significant 
particle agglomeration, the RF value of 0.1 assumed in the DSA cannot be technically justified. 

Relevant experimental data using representative test materials is limited and the 
information that is available in the technical literature on agglomeration phenomenology for 
finely divided HS-Pu provides contradictory conclusions. There are studies and reports that refer 
to agglomeration of HS-Pu in moist environments, such as deactivated gloveboxes and hot cells; 
however, such conditions do not exist at PF-4 due to rigorous climate control and quality 
requirements that prohibit the introduction of considerable amounts of moisture into PF-4 
gloveboxes. 

The staff believes that the RF values assumed in the DSA for finely divided HS-Pu 
powder are non-conservative for both spill and fire releases. If the seismically-induced fire 
analysis used the technically defensible RF value of 1.0 (for both spill and fire components of the 
accident), the Board's staff estimates the overall mitigated offsite dose consequence would 
increase by a factor of 3.3. 

Lack of Independent Review for DSA Input Documents. The accident analysis for the 
seismically-induced fire scenario references several supporting calculations and analyses that 
supply important quantitative inputs to the DSA. The quality and fidelity of the inputs from 
these supporting documents affects the quality and fidelity of the analysis in the DSA. At 
LANL, procedure AP-341-605, Calculations, specifies the institutional requirements governing 
the preparation and review of calculations and analyses that provide important quantitative inputs 
to safety basis documents such as DSAs. AP-341-605 requires that all safety basis input 
calculations and analyses be checked and independently reviewed by personnel who were not 
involved with the development of the calculation or analysis. The staff identified multiple 
analyses that provide quantitative inputs to the safety basis and are explicitly referenced by the 
DSA that did not comply with the independent review requirement of AP-341-605. The 
examples summarized below echo quality assurance issues for DSA input documents that were 
communicated by the Board in a letter dated May 30, 2008: 

• Reference 3-65, LA-UR-1 1-01857, Modeling the Number of Ignitions Following an 
Earthquake: Developing Prediction Limits for Overdispersed Count Data, 
documents statistical analysis on historical data deriving the probability that a given 
number of laboratory room fires will occur after a PC-3 seismic event. Results from 
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this analysis are used as quantitative inputs to the DSA. Site analysts did not apply 
the required AP-341-605 review process to LA-UR-11-01857. 

• Reference 3-112, Memo SB-PF: 10-007, Statistical Evaluation of Damage Ratio 
Data, documents statistical analysis on fire test data for two safety-class containers. 
Results from this memo were used to support a credited damage ratio of 0.01 for the 
safety-class containers in the DSA. Site analysts did not apply the required AP-341- 
605 review process to memo SB-PF: 10-007. 

Credibility of a Seismically-Induced Fire in the Basement. The 2011 DSA assumes 
that a seismically-induced fire is not credible in the PF-4 basement. However, the basement 
houses combustible material, high voltage electrical switchgear that is not seismically qualified, 
and activation of the seismic switches does not remove the source of power to the switchgear. 
The analysis in the DSA does not consider these factors when concluding that a seismically 
induced fire is not credible. There is a significant amount of MAR stored in the facility 
basement that could provide an important contribution to the offsite consequence if it were 
involved in a seismically-induced fire. Furthermore, the leak path factor for other postulated 
basement fires involving flammable liquids is a relatively high value of 30 percent. The 
consequences from a fire in the basement should either be accounted for or additional technical 
justification should be provided to defend the assumption that a seismically-induced fire in the 
facility basement is not credible. 

Probabilistic Fire Analysis. As part of the DSA development, LANL personnel 
performed a probabilistic analysis of a fire at PF-4 following a PC-3 earthquake. Based on this 
analysis, the DSA states that one random (or "probabilistic") fire will occur after a PC-3 seismic 
event. The DSA also postulates three additional "deterministic" fires to account for operations 
involving molten plutonium metal that could significantly increase the likelihood of initiating a 
fire. The probabilistic analysis is based on data in Reference 3-65, LA-UR-1 1-01857, Modeling 
the Number of Ignitions Following an Earthquake: Developing Prediction Limits for 
Overdispersed Count Data, related to fires following earthquakes in Alaska and California. This 
data is used to derive the likelihood of a fire as a function of facility square footage and peak 
ground acceleration of the seismic event. The staff identified the following issues with the use of 
this probabilistic analysis: 

• Site analysts did not follow the applicable LANL review procedure to validate the 
probabilistic analysis. 

• The source data does not account for multiple fires in one structure. 

• The source data does not reflect the seismic upgrades that may have been applied to 
some structures in California to comply with building code requirements. 

• The data set is limited, includes significant reports from residential areas and may not 
be representative of the likelihood of a fire in a facility like PF-4. 
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• Based on the stated purpose of the data set (to "allow fire departments and emergency 
planners to quickly estimate the number of ignitions they may be confronted with..."), 
it does not appear appropriate for predicting the likelihood of a fire in an individual 
unique facility like PF-4. The authors note that "there is considerable uncertainty on 
estimates derived using these relations" to estimate ignitions per million square feet 
of floor space. 

Additionally, site analysts did not effectively use the guidance provided by the DOE Risk 
Assessment Technical Expert Working Group that was established in response to the Board 
Recommendation 2009-1, Risk Assessment Methodologies at Defense Nuclear Facilities, to 
assist in the appropriate preparation of quantitative risk assessments. 

Conclusion. Based on the Board's staff review, the DSA utilizes several non- 
conservative parameters and methodologies in deriving the 23 rem TEDE mitigated off-site dose 
consequence from this scenario. Use of appropriately conservative parameters and 
methodologies would significantly increase the dose consequence for this postulated accident, to 
100 rem TEDE or greater, and compel the application of necessary safety controls. 
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